OtterSec Get in touch

HOW WE AUDIT

Different systems call for different techniques

Different systems call for different techniques. We’ve built our own fuzzers and verification tooling, and we pick the mix that fits yours.

$1.00B+Vulnerabilities patched
120+Projects audited
Public audits Get an audit

Trusted by teams building the next generation of crypto

Formally verified the Aptos stdlibMaintainers of AnchorPublic audit reports

HOW WE AUDIT

The process

  1. 01

    A scoping call

    Tell us your goals, timeline and security needs, and we work out together whether we’re the right fit.

  2. 02

    MNDA and repositories

    Under an MNDA, we review the repositories in scope to understand your project and what you’re asking for.

  3. 03

    A clear quote

    Pricing follows the expected duration, the potential vulnerabilities and how complex the system is.

  4. 04

    The audit

    Researchers start work, raise findings as they appear and come to you with questions along the way.

  5. 05

    Your report

    You receive the written findings with suggested fixes, and we stay close after it ships.

Start the conversation

CLIENTS

Clients on our rigor

“Their website says protecting Blockchain ideas, but their command of JavaScript is impressive. If you've got something that you think would be "too hard for pentesters to understand" - these folks will surprise you. They're not your average pentester.”
Zbigniew Tenerowicz Zbigniew TenerowiczMetaMask
“As a blockchain, speed, scalability, and security are critical to our everyday operations. OtterSec's responsiveness, attentiveness, and talent are second-to-none when it comes to securing Solana's core code.”
Dominic Tsang Dominic TsangSolana Foundation

FAQ

About our methods

Is it only manual review?

No. Different systems call for different techniques. Pentesting, formal verification and fuzzing are core disciplines, and we pick the mix that fits yours.

Which languages do you cover?

Solidity, Vyper, Solana Rust, CosmWasm, Go, Aptos Move, Sui Move, JavaScript, Circom, Halo 2 and more, plus Web2 frontends and backends in JavaScript, Rust and Python.

Can we read past audits?

Yes. Every public security review from the OtterSec team is listed at osec.io/audits.

Who have you worked with?

Teams including Solana, Tether, Sui, Aptos, Circle, Movement, LayerZero, Wormhole, MetaMask, Jupiter, Pyth, Phantom, Jito and Backpack.

GET AN AUDIT

Get the techniques your system actually needs

Start with a conversation about your goals and security needs. We’ll scope the right mix.

Start the conversation